#! /bin/sh 

# 更新系统
yum update -y
yum install -y yum-utils
yum -y install wget
timedatectl set-timezone Asia/Shanghai 
yum install -y ntpdate
systemctl stop firewalld
systemctl disable firewalld.service 

# 安装 jdk
cd /usr/local
tar -zxvf jdk-8u191-linux-x64.tar.gz

echo '
export JAVA_HOME=/usr/local/jdk1.8.0_191/ 
export CLASSPATH=$:CLASSPATH:$JAVA_HOME/lib/ 
export PATH=$PATH:$JAVA_HOME/bin

'>>/etc/profile

source /etc/profile

# 安装nginx
if [ ! -f "/usr/local/nginx-1.18.0.tar.gz" ]; then
wget -cP /usr/local https://agent.llootong.cn/lltfile/his/nginx-1.18.0.tar.gz
fi

yum -y install gcc pcre-devel zlib-devel openssl openssl-devel
cd /usr/local/
tar zxvf nginx-1.18.0.tar.gz
cd /usr/local/nginx-1.18.0
./configure --prefix=/usr/local/nginx --with-stream --with-http_stub_status_module --with-http_ssl_module 
make
make install

cd /usr/local/nginx/
rm -rf /usr/local/nginx/conf/nginx.conf
wget -cP /usr/local/nginx/conf/  https://agent.llootong.cn/lltfile/his/nginx.conf
wget -cP /usr/local/nginx/zs/ https://agent.llootong.cn/lltfile/his/xxx.pem
wget -cP /usr/local/nginx/zs/ https://agent.llootong.cn/lltfile/his/xxx.key


useradd nginx -m
passwd -l nginx

mkdir -p /usr/cloud
chmod 777 -R /usr/local/nginx/
chmod 777 -R /usr/cloud
chmod 644 -R /usr/local/nginx/conf/nginx.conf

ln -sf /usr/local/nginx/sbin/nginx /usr/bin/nginx
nginx

# 创建启动jar目录
rm -rf /jar/start.sh
wget -cP /jar/ https://agent.llootong.cn/lltfile/his/start.sh
# 转换编码
yum install -y dos2unix
dos2unix /jar/start.sh
chmod +7 /jar/start.sh

#创建软链接 使用jar start all命令
ln -s /jar/start.sh /usr/bin/jar

rm -rf /jar/bootstrap.properties
wget -cP /jar/ https://agent.llootong.cn/lltfile/his/bootstrap.properties

if [ ! -f "/jar/application.properties" ]; then
wget -cP /jar/ https://agent.llootong.cn/lltfile/his/application.properties
fi

# 开机启动 nginx 所有服务
sudo tee /etc/rc.d/init.d/autostart.sh<<-'EOF'
#!/bin/sh
#chkconfig:2345 80 90
#decription:autostart

/usr/local/nginx/sbin/nginx

/jar/start.sh start all

EOF

chmod 755 /etc/rc.d/init.d/autostart.sh

cd /etc/rc.d/init.d
chkconfig --add autostart.sh
chkconfig autostart.sh on

# 安装 docker

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum -y makecache fast

#安装	
yum -y install docker-ce-18.03.1.ce
yum -y install docker

#加速配置
mkdir -p /etc/docker
tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/","https://almtd3fa.mirror.aliyuncs.com"]
}
EOF

#启动	
systemctl start docker
#开机启动	
systemctl enable docker


# 安装 redis
docker run -d -m 4g --name myredis -p 6379:6379 --restart unless-stopped redis:3.2 --requirepass "123"

mkdir -p /docker/mysql/logs /docker/mysql/conf /docker/mysql/data

#安装mysql 5.7
sudo tee /docker/mysql/conf/my.cnf <<-'EOF'
[client]  
default-character-set=utf8mb4  
[mysql]  
default-character-set = utf8mb4
[mysqld]  
character-set-server = utf8mb4  
collation-server = utf8mb4_unicode_ci  
init_connect='SET NAMES utf8mb4'  
skip-character-set-client-handshake = true  
#修改mysql配置文件my.cnf，在[mysqld]段中添加或修改max_connections值：
group_concat_max_len=102400
max_connections=2048
default-time-zone='+08:00'
sql-mode=STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
EOF
docker run --name mysql5.7 -m 4g -p 3306:3306 -v /docker/mysql/data:/var/lib/mysql -v /docker/mysql/conf:/etc/mysql/conf.d -e MYSQL_ROOT_PASSWORD=lulutong321 -d  --restart unless-stopped mysql:5.7

#安装 nacos
docker run -d -m 2g  -e PREFER_HOST_MODE=ip -e MODE=standalone -p 8849:8848 --name nacos1.4.1 --restart=always nacos/nacos-server:1.4.1

# 安装 rabbit mq
docker run -d -m 2g  --hostname my-rabbit --name rabbit -p 15672:15672 -p 5672:5672 --restart=always rabbitmq:3.7.7-management
# 安装延时队列
docker cp /usr/local/rabbitmq_delayed_message_exchange-3.8.0.ez rabbit:/plugins
docker exec rabbit rabbitmq-plugins enable rabbitmq_delayed_message_exchange
docker restart rabbit


# 审计
echo '
-w /var/lib/docker -k docker
-w /etc/docker -k docker
-w /usr/lib/systemd/system/docker.service -k docker
-w /usr/lib/systemd/system/docker.socket -k docker
-w /usr/bin/docker-containerd -k docker
-w /usr/bin/docker-runc -k docker
'>>/etc/audit/audit.rules


echo '
-w /var/lib/docker -k docker
-w /etc/docker -k docker
-w /usr/lib/systemd/system/docker.service -k docker
-w /usr/lib/systemd/system/docker.socket -k docker
-w /usr/bin/docker-containerd -k docker
-w /usr/bin/docker-runc -k docker
'>>/etc/audit/rules.d/audit.rules

service auditd restart



#限制容器之间的网络流量
tee /usr/lib/systemd/system/docker.service<<-'EOF'
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target

[Service]
Type=notify
ExecStart=/usr/bin/dockerd --icc=false
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
TimeoutStartSec=0
Delegate=yes
KillMode=process
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s

[Install]
WantedBy=multi-user.target

EOF

systemctl daemon-reload
systemctl restart docker
